# Signed content and membership

Verify a message, its signing device, and the separate relationship to its recipient.


Portable signed text lets someone send a message with evidence of the device that signed it and the persona that device belongs to. The recipient can verify that evidence locally, then separately ask whether their own trust reaches the sender.

## Three checks, three meanings

| Check | What it establishes |
| --- | --- |
| Content signature | The normalized text matches the statement signed by the device key |
| Issuer-signed device certificate | The issuer attested that key's membership in the named persona |
| Recipient's verified reachability query | A qualifying path from the recipient's persona to the sender in the cited graph commitment |

Do not merge these into a single unexplained “verified” label.

## Create a portable message

The sender requests a certificate for their own device and node, verifies the issuer and selected key/node, then creates a content statement. `createContentStatement` hashes text after `lf-v1` normalization: CRLF and CR become LF. It does not strip whitespace or normalize Unicode.

`signer.signContent` signs the statement. `formatSignedContent` appends a canonical evidence block. The statement commits to the whole membership certificate, including its random certificate identifier.

The recipient uses `parseContentMessage` and `verifySignedContent` with pinned issuer verification and cryptographic adapters. Parsing rejects ambiguous markers, extra text and malformed evidence.

## Check current status separately

A certificate can have a valid signature even after expiry or revocation. A fresh signed certificate-status response binds the certificate digest and a caller nonce. The SDK checks the issuer and a 60-second freshness bound.

Status checks send the certificate and nonce, not the message plaintext or content hash. If status is not checked, label it “status not checked”. Offline verification does not become a current-valid claim.


**Does not establish**
A valid content signature does not prove when the text was signed, current device access, delivery, recipient trust, historical validity, or permission to act. A sender-chosen date is not signing-time evidence.

## Add the recipient's perspective

After verifying the sender evidence, query reachability from the recipient's own node to the sender's stable node. Verify the returned attestation locally using the same rules as the [quickstart](/quickstart).

[Signed messages](/build/signed-messages) applies this pattern to mail and text channels. [OpenPGP keys](/build/openpgp-keys) and [Git signer membership](/build/git-signers) use related membership checks for existing signing keys.